Skip to content

gh-160898: Reject null bytes in socket.getaddrinfo() host and port - #160899

Merged
StanFromIreland merged 4 commits into
python:mainfrom
sethmlarson:nulls-getaddrinfo
Oct 29, 2026
Merged

gh-160898: Reject null bytes in socket.getaddrinfo() host and port#160899
StanFromIreland merged 4 commits into
python:mainfrom
sethmlarson:nulls-getaddrinfo

Conversation

@sethmlarson

@sethmlarson sethmlarson commented Oct 29, 2026 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Contributor

Reject null bytes in host and port of socket.getaddrinfo.

@sethmlarson
sethmlarson requested a review from gpshead October 29, 2026 14:38
@sethmlarson sethmlarson added type-security A security issue needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes topic-socket Related to the socket, socketserver and selectors modules labels Oct 29, 2026
@bedevere-app bedevere-app Bot mentioned this pull request Oct 29, 2026
Open
@read-the-docs-community

read-the-docs-community Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #35500805 | 📁 Comparing 92ff489 against main (8a5e24a)

  🔍 Preview build  

2 files changed
± library/socket.html
± whatsnew/changelog.html

StanFromIreland
StanFromIreland reviewed Oct 29, 2026
View reviewed changes
Comment thread Doc/library/socket.rst Outdated
StanFromIreland
StanFromIreland approved these changes Oct 29, 2026
View reviewed changes

@StanFromIreland StanFromIreland left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, just two little docs nits.

Comment thread Misc/NEWS.d/next/Security/2026-10-27-16-25-40.gh-issue-160898.epi53X.rst Outdated
StanFromIreland
StanFromIreland reviewed Oct 29, 2026
View reviewed changes
Comment thread Misc/NEWS.d/next/Security/2026-10-27-16-25-40.gh-issue-160898.epi53X.rst Outdated
@StanFromIreland StanFromIreland changed the title gh-160898: Reject null bytes in getaddrinfo() host and port gh-160898: Reject null bytes in socket.getaddrinfo() host and port Oct 29, 2026
@sethmlarson

sethmlarson commented Oct 29, 2026

Copy link
Copy Markdown
Contributor Author

@StanFromIreland the failure seems unrelated (test_profiling failing in ASan?) I'll try running again, but are we okay merging anyway in case it fails again?

@StanFromIreland

StanFromIreland commented Oct 29, 2026

Copy link
Copy Markdown
Member

It's a known flaky test (there's an issue somewhere) you'll have to re-run till it passes as the job is required.

@StanFromIreland
StanFromIreland enabled auto-merge (squash) October 29, 2026 16:30
@StanFromIreland

StanFromIreland commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

I enabled auto-merge, I'll check in on this every half-hour till it lands (usually it takes 1-2 runs).

Edit: Aargh, re-run failed. Guess we'll go again!

@StanFromIreland
StanFromIreland merged commit 131a3a6 into python:main Oct 29, 2026
195 of 202 checks passed
@miss-islington-app

miss-islington-app Bot commented Oct 29, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR, and @StanFromIreland for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

@miss-islington-app

miss-islington-app Bot commented Oct 29, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson and @StanFromIreland, I could not cleanly backport this to 3.15 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 131a3a66c5f400b588f9fd2732a5ed4e89623ee3 3.15

@miss-islington-app

miss-islington-app Bot commented Oct 29, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson and @StanFromIreland, I could not cleanly backport this to 3.14 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 131a3a66c5f400b588f9fd2732a5ed4e89623ee3 3.14

@miss-islington-app

miss-islington-app Bot commented Oct 29, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson and @StanFromIreland, I could not cleanly backport this to 3.13 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 131a3a66c5f400b588f9fd2732a5ed4e89623ee3 3.13

@miss-islington-app

miss-islington-app Bot commented Oct 29, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson and @StanFromIreland, I could not cleanly backport this to 3.12 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 131a3a66c5f400b588f9fd2732a5ed4e89623ee3 3.12

@miss-islington-app

miss-islington-app Bot commented Oct 29, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson and @StanFromIreland, I could not cleanly backport this to 3.11 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 131a3a66c5f400b588f9fd2732a5ed4e89623ee3 3.11

@sethmlarson
sethmlarson deleted the nulls-getaddrinfo branch October 29, 2026 17:48
@bedevere-app

bedevere-app Bot commented Oct 29, 2026

Copy link
Copy Markdown

GH-160925 is a backport of this pull request to the 3.15 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label Oct 29, 2026
@bedevere-app

bedevere-app Bot commented Oct 29, 2026

Copy link
Copy Markdown

GH-160926 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Oct 29, 2026
@bedevere-app

bedevere-app Bot commented Oct 30, 2026

Copy link
Copy Markdown

GH-160974 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Oct 30, 2026
@bedevere-app

bedevere-app Bot commented Oct 30, 2026

Copy link
Copy Markdown

GH-160975 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Oct 30, 2026
@bedevere-app

bedevere-app Bot commented Oct 30, 2026

Copy link
Copy Markdown

GH-160977 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Oct 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@StanFromIreland StanFromIreland StanFromIreland approved these changes
@gpshead gpshead Awaiting requested review from gpshead

Assignees

@sethmlarson sethmlarson

Labels

release-blocker topic-socket Related to the socket, socketserver and selectors modules type-security A security issue

Projects

Release and Deferred blockers 🚫
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sethmlarson @StanFromIreland